topic Re: Monitor CPU, Disk and Ram. in Monitoring Splunk

Monitor CPU, Disk and Ram.

fsrodriguez — Sun, 10 Dec 2017 15:37:15 GMT

How can I create a radial gauge that would display CPU? and what would be the command for Disk and RAM?

Thank you in Advance.

Re: Monitor CPU, Disk and Ram.

kamlesh_vaghela — Mon, 11 Dec 2017 07:34:31 GMT

Hi @fsrodriguez,

Have you checked this link?

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/CreateGauges
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Gauge

Thanks

Re: Monitor CPU, Disk and Ram.

nickhills — Mon, 11 Dec 2017 08:42:20 GMT

The links above detail how to chart the data if you have it, but Is your question:
How do I get CPU/Disk/Ram metrics into Splunk?

If so, can you detail which operating systems you are interested in monitoring?

Re: Monitor CPU, Disk and Ram.

niketn — Tue, 29 Sep 2020 17:12:22 GMT

@ fsrodriguez, can you try the following run anywhere search?

| makeresults
| head 1
| eval yourCPUFieldName=14.2
| gauge yourCPUFieldName 0 10 30 50

If the same works you need to replace | makeresults with your base search to get CPU Value.
| head 1 gets only the latest result for CPU
If you want the CPU for multiple hosts you can leverage the Trellis Layout, provided your are on Splunk Enterprise version 6.6 or later.

PS: I have used run anwhere dashboard to use Splunk's _introspection index to get the CPU percent. Also I have used date_hour in the query and also for Trellis split by <option name="trellis.splitBy">date_hour</option>. You would need to replace your query and also convert from date_hour to host

<dashboard>
  <label>Radial Gauge for CPU</label>
  <row>
    <panel>
      <title>CPU by date_hour</title>
      <chart>
        <search>
          <query>index="_introspection" sourcetype="splunk_resource_usage" data.pct_cpu=*
| stats latest(data.pct_cpu) as CPU by date_hour</query>
          <earliest>-4h@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">collapsed</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">radialGauge</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.rangeValues">[0,60,85,100]</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.gaugeColors">["0x84E900","0xFFE800","0xBF3030"]</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">none</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">1</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
        <option name="trellis.splitBy">date_hour</option>
      </chart>
    </panel>
  </row>
</dashboard>

Re: Monitor CPU, Disk and Ram.

fsrodriguez — Mon, 11 Dec 2017 13:22:57 GMT

I'm trying to pull it from an Amazon Linux AMI.

Re: Monitor CPU, Disk and Ram.

fsrodriguez — Mon, 11 Dec 2017 13:50:29 GMT

Yes I've seen that documentation, thank you. I know how to create it but I don't know how to pull the data values I need. CPU RAM and MEM.

Re: Monitor CPU, Disk and Ram.

sbbadri — Tue, 29 Sep 2020 17:11:06 GMT

@fsrodriguez

please download https://splunkbase.splunk.com/app/833/#/details.

1) Deploy this Splunk_TA_nix to the servers were you have to monitor
2) Enable CPU,RAM and DISK script
3) restart the server.
4) you will get the data under os index.

Try with NMON . It will pull you all necessary metrics from linux hosts ( except HPUX os)
https://splunkbase.splunk.com/app/3248/ - TA-nmon - need to be install/deployed on UF / hosts
https://splunkbase.splunk.com/app/1753/ - NMON APP - need to be installed or deployed on SH (But look for data model settings)

I hope this helps you.

Re: Monitor CPU, Disk and Ram.

fsrodriguez — Tue, 29 Sep 2020 17:11:15 GMT

I already had Splunk_TA_nix Installed. Thank you so much!

This is all I had to do:
host="app-1" source="cpu" | gauge cpu_load_percent 25 50 65 75 85 95 100